ssh-copy-id permission denied

Question

I'm trying to set up a git repo for a project and therefore I want to make use of ssh keys in order to not re-enter my password every time. I stumbled over the possibility to let ssh do the copying work with ssh-copy-id, however it does not seem to work out for me.

$ ssh-copy-id -i git@server
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: 
"/c/Users/Me/.ssh/id_rsa.pub"
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to 
filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are 
prompted now it is to install the new keys
git@server's password:
sh: 1: cannot create .ssh/authorized_keys: Permission denied

Edit: I solved the problem the following way: - logged in root via su - changed ownership of the authorized_keys file via chown git /home/git/.ssh/authorized keysto git - then logged git back in - lastly changed the rw permission to 600 via chmod 600 ~/.ssh/authorized keysand successfully copied the key over

Answer 1

If an account is dedicated to git usage, it makes sense for the administrator to make it a restricted account, only allowed to run git commands. In particular, git access should not be enough to change the credentials and restrictions on the account. This is done by having a ~/.ssh/authorized_keys that isn't writable by the user. There is usually an out-of-band mechanism to set up credentials, for example a web interface.

If you're the administrator, you need to dig in to find out how the git accounts are set up. Check the SSH server configuration (/etc/sshd_config or /etc/ssh/sshd_config to see where the authorized_keys files are located (AuthorizedKeysFile setting). Once you've found the file, add the public key to it: an authorized_keys files is just a list of line, each normally containing a public key copied straight from a .pub file. Check the configuration to see whether restrictions on the use of the key should be added at the end of the file (e.g. command="git-shell" nopty no-agent-forwarding no-port-forwarding no-X11-forwarding).

Answer 2

Let us consider we have 2 machines, 'A' and 'B' Now you want to connect from A to 'B'

So in B machine do the following

vi /etc/ssh_sshd_config

Now search for this two line and change to the following as shown below.

PasswordAuthentication yes

PermitRootLogin yes

Now Restart the sshd service in 'B' machine

service sshd restart

Now copy the key from 'A' machine to 'B' machine and I hope it will Work fine

ssh-copy-id root@154.34.22.109

Answer 3

As this questions appears among the first search results when googling for this error, I will also add my solution:

In my case it was nothing related to the permissions. For any reason (didn't bother myself to find out for which reason actually, as I found a quick fix) when executing the ssh command the program didn't look for the right identity file. One solution was to add on the remote server an SSH key which the SSH program tried to use. You can observe what the SSH program does when executing the command by adding -v to the command:

ssh -v username@your-host-ip-or-domain 

Then you just grab on your local machine any public key the SSH program tries to use, for example (on a Mac):

cat ~/.ssh/id_rsa.pub

... and add it to the remote's authorized_keys file in:

~/.ssh/authorized_keys

Another, in my case better solution was to add a custom host in my local ssh config file. On my Mac it is:

/Users/my-user-name/.ssh/config

Here you can add for example something like this:

Host mynewserver
        HostName some.IP.number.or.domain
        Port 20000 #if custom port is used and not the default 22
        User the_root
        PreferredAuthentications publickey
        IdentityFile ~/.ssh/id_rsa_for_my_new_server

Then you just need to execute:

ssh mynewserver

...and Voilà